Access elements: Principal

When a request reaches an AWS API, the IAM service needs to allow or deny it. But before we dive into how it does that, let’s see what information it has.

A request represents that somebody(1) wants to do something(2) with something(3).

Let’s see what each of these 3 parts mean.

The first one is the Principal. It is the user, the role, the AWS service, or some special entity that sends the request.

The second part is the Action. It defines what the Principal wants to do, such as reading an object or creating a new Lambda function.

The third is the Resource. It is the logical entity in the account that is the subject of the request. For example, the specific S3 bucket to delete, or the EC2 instance to launch.

Let’s look at some examples.

• An IAM user, Bob, reads an object from an S3 bucket. The Principal is Bob, the action is s3:GetObject, and the resource is the S3 object.

• An IAM role, Admin, calls a Lambda function. The Principal is the Admin role, the action is lambda:InvokeFunction, and the resource is the function itself.

• A visitor opens an S3 bucket website in the browser. The Principal is the anonymous user, a special entity, the action is s3:GetObject, and the resource is the index.html object.

• Finally, an API Gateway calls a Lambda function. The Principal is the apigateway.amazonaws.com service, the action is lambda:InvokeFunction, and the resource is the function.

Recap:
The Principal is the entity that is initiating the request.
The Action is the operation.
The Resource is the target of the operation. ...